The present invention relates to a multi-lane controller. Such a controller may be used for gas turbine engines, for instance for use as aero-engines.
A system in which control is primarily or wholly effected by signals from digital data processors, such as computers, is commonly referred to as a full authority digital control system. In order to increase the reliability of such a system, it is known to provide duplicated control channels or "lanes" each of which includes a data processor and its associated input and output devices. At any time, one of the lanes controls the engine and the other is in a stand-by mode. Internal self-monitoring of each computer is provided and, should a fault occur in the computer of the lane which is presently in control, this lane is deactivated and the other lane changes from stand-by operation to being in control.
In order to improve the fault detection and/or accommodation capability of a dual lane control system, it is known to provide cross-coupling of information between the lanes. In one known arrangement, a serial data highway is provided between the data processors in the two lanes so as to exchange predetermined data. Such an arrangement is shown in FIG. 1 (Prior Art) of the accompanying drawings, in which lane A comprises an input-output interface 1a and a computer 2a, lane B comprises an input/output interface 1b and a computer 2b, a lane selector 3 selects which of lanes A and B is in control, and a serial data highway 4 is provided between the computers 2a and 2b. However, such an arrangement requires that both lanes must be working correctly for the cross coupling to be operative. Also, there is an additional processing delay associated with the data received from the computer of the other lane which affects the tolerance which can be applied to cross comparison safety checks. Further, the process delay can also affect control performance if substitute data is used in the main control loops.
FIG. 2 (Prior Art) of the accompanying drawings illustrates another known arrangement with like parts being referred to by the same reference numerals. This arrangement provides cross-coupling by connecting the interfaces 1a and 1b of both lanes to the computer (2a in FIG. 2) which is presently in control. The lane selector 3 controls electronic switches 5a and 5b which connect the computer in control 2a to the interfaces 1a and 1b and disconnect the computer in standby 2b from the interfaces. This arrangement avoids the process delay problems of the arrangement of FIG. 1 because the lane in control has direct access to all input and output functions. Further, continued exchange of data is possible following failure of either processor. However, this arrangement is more complex and has the disadvantage that the computer in the standby lane is disconnected from the interfaces and hence is only able to perform background housekeeping tasks. Thus, when it becomes necessary to put lane A in standby and lane B in control, the lane B has to be initialised, with associated delays and software complexity.
EP 0 435613 describes a redundant system comprising a plurality of channels each divided into a sensor block and a computational block. A bus interface controller in each channel interfaces the sensor and computational blocks within that channel and co-ordinates transfer of sensor information to and from the computational block. The bus interface controllers exchange information with one another. Thus if a computational block fails, cross channel transfer of sensor information can continue; if one sensor block fails, the processing facilities of that channel can still be utilised. However, this system has the disadvantage that sensor data in a first channel may only be accessed by the computational block of a second channel via the bus interface of the first channel. The system therefore relies on the integrity of the bus interface controller.